Privacy Policy

This policy explains what personal information SongPulse collects, why, who it's shared with, how long it's kept, and the choices and rights you have. SongPulse (“we”) is responsible for it. It covers songwriters with accounts, and also people who use SongPulse without one: listeners, industry contacts, collaborators and people who ask for an invite.

The short version

• We collect what's needed to run SongPulse, and use it for that.
• We don't sell personal information, and there are no ad trackers.
• News emails only go to people who opted in, and every one has an unsubscribe link.
• You can ask for a copy of your data, or for it to be deleted, at any time.

What we collect

• Account details: name, email, password (stored only as a one-way hash), when you log in, and the Terms version you agreed to.
• Your content: songs, links, lyrics, notes, artwork, pages, campaigns, collections, collabs, and rights declarations (including co-writer names and splits you enter).
• Listening data: when someone opens a SongPulse link we record how they listened (plays, how far, skips), and their ratings and answers. Listener emails, when given, are stored as one-way hashes, except when a listener asks us to email them their saved songs.
• People you add: names, roles and (optionally) emails of industry contacts and collaborators you send links to.
• Collab posts: what collaborators write and post in a collab, under the name the songwriter gave them.
• Invite requests: name, email, what you tell us about your music, and a link to it.
• Payments: your plan, payment status and billing history from Stripe. Card details stay with Stripe.
• Email choices: whether you opted in to news emails, and a record of each consent you give or withdraw (what, when, where).
• Technical data: IP address, browser and device details in our server logs, used for security, rate limits and fixing problems.

How we use it, and why we're allowed to

• To provide SongPulse (to perform our contract with you): accounts, playing songs, results, pages, collabs, AI features you use, billing, and the emails the service needs (invitations, password resets, collab updates, receipts).
• To keep it safe and working (our legitimate interests): security, preventing abuse and fraud, fixing bugs, and improving features.
• For aggregate insights (our legitimate interests): de-identified, combined statistics, such as what makes listeners stop early. These never identify a person or a song.
• For news and tips by email (your consent): only if you opted in. You can withdraw any time, which doesn't affect anything before.
• To meet legal obligations: tax and accounting records, and responding to lawful requests.

AI processing

When you use an AI feature, we send what it needs (for example a song's audio, lyrics and notes) to Google Gemini or Anthropic Claude. We use their paid API services, whose terms don't let them use it to train their models; they process it only to return results to you. Audio sent for listening is deleted from Google once it's processed. We don't use AI to make decisions about you that have legal or similar effects.

Email

• Service emails (invitations, password resets, collab updates, receipts) are part of using SongPulse.
• News emails go only to people who ticked the opt-in box. Each has an unsubscribe link and a one-click unsubscribe your mail app can show. You can also change this on your Account page. We keep a record of your choice.
• Industry contacts and collaborators get emails only about the songs and collabs they were invited to, never news, unless they opt in themselves.

Who we share it with

• Service providers who run parts of SongPulse for us, under contracts that limit them to doing so:
  • Vercel: Hosting the website and app
  • Neon: Our database
  • Microsoft (365): Sending email
  • Google (Gemini): AI listening and cover art, when you use them
  • Anthropic (Claude): AI writing and artist suggestions, when you use them
  • Stripe: Payments and billing
• People you share with: listeners, industry contacts and collaborators see what's on the links and pages you send them. Collaborators see the collab thread, including the other participants' names and posts.
• A change of ownership: if SongPulse is sold, merged or reorganised, personal information may transfer to the new owner, who must keep honouring this policy for it. We'll tell you before that happens.
• The law: when required by law, or to protect people's rights and safety.

We don't sell personal information or share it for cross-context behavioural advertising, as those terms are used in California law.

Where it's stored

SongPulse runs in the United States. If you're elsewhere, your information is transferred there. Where the law requires, we rely on safeguards such as the European Commission's Standard Contractual Clauses in our providers' terms.

How long we keep it

• Account and content: while your account is open. When you close it we delete them within 30 days (backups roll off within a further 30).
• Listening data on your links: while the campaign or link exists; deleted with it.
• Invite requests: until we invite you, or up to 2 years if we don't (sooner on request).
• Password reset links expire after an hour, and invitation links after 14 days.
• Payment records: as long as tax law requires (usually up to 7 years).
• Consent records: as long as needed to show what was agreed, even after you unsubscribe.
• Server logs: up to 30 days.

Security

Passwords and links' secret tokens are stored only as one-way hashes, connections are encrypted, and access to data is limited to what each part of SongPulse needs. No system is perfectly secure; if a breach affects you, we'll tell you as the law requires.

Your rights

Wherever you live, you can ask us to:

• give you a copy of your personal information (in a portable format);
• correct it (much of it you can edit yourself);
• delete it, or close your account;
• stop sending you news emails (use the unsubscribe link or your Account page).

In the EU, UK and similar places you can also object to or ask us to restrict some uses, and complain to your data protection authority. In California and other US states with privacy laws you can also know what we collect and why, and you won't be treated differently for using your rights. To use any right, email andrew@songpulse.io. We'll confirm it's you (usually by replying to your account email) and answer within 30 days. If we decline, you can ask us to reconsider.

If you don't have an account

If you listened to a song, were sent an industry link, or were added to a collab, a songwriter shared the link with you and may have given us your name, role or email. We use it only to run that link or collab. Email andrew@songpulse.io to have it deleted, or ask the songwriter to remove you.

Cookies

SongPulse uses only cookies it needs to work: one keeps you logged in, one remembers a listener on a link so their listening counts once, and one remembers that you entered the password for a password-protected link. No advertising or cross-site tracking cookies, so there's no cookie banner.

Children

SongPulse isn't for children under 16. If you think a child has given us personal information, contact us and we'll delete it.

Changes

If we change this policy materially, we'll tell you by email or in the app before it applies, and ask account holders to accept the new version. The date at the top shows the current version. See also our Terms of Service.

Contact

Privacy questions or requests: andrew@songpulse.io.